Case file contents and verification

Log identifier, leaf index and leaf hash

When a detection carries these three coordinates, anyone can request the corresponding entry from the log operator through the public Certificate Transparency interface and obtain the certificate that produced it, with the date and time of its entry, as attested by the log. The check is independent of us: the log is run by a third party and is append-only.

In the window, 2,900 of the 5,856 critical domains (50%) carry the three coordinates, with attested provenance; for these, the system computes the inclusion proof on request: that this certificate sits in that signed tree, checkable against the log’s checkpoint. For the others, the case file says so explicitly.

The attested share is published, and each case file says which side it is on.

Format, fingerprint and time of capture

The copy is captured by a crawler that identifies itself as such, in WARC format (ISO 28500), the web-archiving standard. Every record carries the fingerprint of its content in the format the standard prescribes, SHA-1 in base32, and the capture date and time. The archive holds 4,836,900 records, 1,308,222 of them response records with a fingerprint.

Today every record carries the SHA-1 fingerprint the WARC standard prescribes; the archive schema also provides for SHA-256, not yet present as of the measurement date. SHA-1 protects against error and file corruption. The fingerprint establishes that the file is unchanged; the capture time rests on our own record. The time the certificate was entered, by contrast, is attested by the public log, which is run by a third party.

Copies are viewed in a viewer separate from the console, which runs the preserved HTML in isolation. The same copy can be downloaded as a WARC file and read with any tool that implements the standard.

Coverage: 5,152 of the 5,856 critical domains in the window have at least one copy (88%). The crawler presents itself as what it is, and some sites choose not to serve it: that too stays recorded in the case file.

Extracted fields and recorded model

The classification record stores the model that produced the verdict, the tier at which it was produced, the time taken and the fields extracted from the page text.

The extracted fields, as they are named in the record:

• Legal entity and declared seat

  Who the page says it is, and where it says it is based.

• Authorisations claimed

  The authorisations or registrations the page claims to hold, with the text that claims them.

• Contact channels

  Mail, telephone, chat, forms; and whether contact is possible only through private chat.

• Risk signals

  The indicators: guaranteed returns, authorisation not stated, deposit pressure, artificial urgency, unverifiable testimonials, generated content.

• Inconsistencies

  The page’s internal contradictions: seat in one country, authorisation in another, currency in a third.

• Dates and times

  Certificate entry, page reading, copy capture, last reachability check: each in UTC.

The case file exports as a PDF, in the three languages: declared identity and seat, contact channels, the page sentences that produced the detection, all claimed authorisations, the languages served, the archived copies with fingerprint and position in the WARC file, the matching warnings with the authority that issued them. The model’s interpretation comes last, in a separate box.

Verification of the fingerprint on this page

Below is the text of the record of the specimen that opens this document. Its SHA-256 fingerprint was computed at publication, by an implementation different from your browser’s. The browser now recomputes it, on the text in front of you.

If the two match, you have verified two things at once: that the fingerprint is reproducible, and that the text served has not changed since publication. Change one character: it changes entirely. Put it back: it returns to the same value.